5

How safe is it to give sensitive information to someone over a phone line? Does it matter if the data was verbally spoken or if it was typed in?

Example: Opening an account with an internet provider and they ask for your SSN and/or credit card number.

Thomas Eding
  • 695
  • 5
  • 5

2 Answers2

6

The phone line is not considered a secure end-to-end medium. It is possible the tap into a phone line. The parties who are most interested in tapping your phone aren't interested in having your SSN or Credit Card number (government agencies).

People who are really interested in harvesting SSN and credit card numbers have other means which tend to yield a lot more credit card and social security numbers. You can imagine the incentive it would take to tap on every single phone line across the globe. It's a lot more interesting to use other scams to get to this data, not mentioning the detection rate.

So to conclude, the risk versus effort versus yield is not interesting enough for people to tap into your phone line to get your CC and SSN. People who will do phone tapping are not interested at all in your SSN or CC.

Lucas Kauffman
  • 54,437
  • 17
  • 116
  • 196
  • the lines could have been "tapped" on the other end as well. ie: an employee who wants to collect CC & SSN data of the customers, or an hacker who has access to the recordings of phone conversations but not to the customer database etc – pwnd Nov 20 '13 at 09:54
  • 1
    Sure, malicious employees are a possibility, but hey then I can argue as well that, even if there was a secure line, that the malicious employee has access to the phone or has access to the recordings and can thus also retrieve that information. – Lucas Kauffman Nov 20 '13 at 10:22
2

The short answer is that it's not worth anyone's time and to tap your phone for information of that low a value.

Phones can be tapped yes, chances are that those doing the tapping already have your information available. Even if they didn't, tapping phone lines is a huge effort and could only done with any amount of economy if all your calls could be transcripted automatically and then have the information scraped out. That's a lot of expensive technology there, just to get your credit card or SSN details. If a person was going to do it without that technology they'd be committing themselved to days of tedious work in the hopes of getting one piece of data. It simply isn't worth the effort to do when there's much easier ways of getting that information.

Now if the value of the information is higher it may be worth the effort. Say it's not SSN or Credit card details but information that may effect a stock's price, the value of commodities, government secrets, or give evidence of criminality. The value of the information is greater than the effort and cost it would take on a phone tap.

Even if your credit card and ssn details were valuable you are hampered by technology. Although there is technology that could encrypt your phone calls, it requires that both sides use it, and it is expensive. To make that work across all banks and people would require investment that is far above the actual value of the information it is protecting, which is why it hasn't been done in the past.

GdD
  • 17,399
  • 2
  • 42
  • 64